Skip to content

Commit 08237fe

Browse files
calladoum-elasticcalladoum-elastic
authored
Add the api value to event.category (#2147)
* Adding `api` to `event.category` * better phrasing for description, added a few extra expected types
1 parent 1794cfb commit 08237fe

8 files changed

Lines changed: 106 additions & 1 deletion

File tree

‎CHANGELOG.next.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ Thanks, you're awesome :-) -->
1616

1717
#### Added
1818

19+
* adding `api` option to `event.category` #2147
20+
1921
#### Improvements
2022

2123
#### Deprecated

‎docs/fields/field-details.asciidoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3389,7 +3389,7 @@ Note: this field should contain an array of values.
33893389

33903390
*Important*: The field value must be one of the following:
33913391

3392-
authentication, configuration, database, driver, email, file, host, iam, intrusion_detection, malware, network, package, process, registry, session, threat, vulnerability, web
3392+
api, authentication, configuration, database, driver, email, file, host, iam, intrusion_detection, malware, network, package, process, registry, session, threat, vulnerability, web
33933393

33943394
To learn more about when to use which value, visit the page
33953395
<<ecs-allowed-values-event-category,allowed values for event.category>>

‎docs/fields/field-values.asciidoc‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -132,6 +132,7 @@ This field is an array. This will allow proper categorization of some events tha
132132

133133
*Allowed Values*
134134

135+
* <<ecs-event-category-api,api>>
135136
* <<ecs-event-category-authentication,authentication>>
136137
* <<ecs-event-category-configuration,configuration>>
137138
* <<ecs-event-category-database,database>>
@@ -151,6 +152,18 @@ This field is an array. This will allow proper categorization of some events tha
151152
* <<ecs-event-category-vulnerability,vulnerability>>
152153
* <<ecs-event-category-web,web>>
153154

155+
[float]
156+
[[ecs-event-category-api]]
157+
==== api
158+
159+
Events in this category annotate API calls that occured on a system. Typical sources for those events could be from the Operating System level through the native libraries (for example Windows Win32, Linux libc, etc.), or managed sources of events (such as ETW, syslog), but can also include network protocols (such as SOAP, RPC, Websocket, REST, etc.)
160+
161+
162+
*Expected event types for category api:*
163+
164+
access, admin, allowed, change, creation, deletion, denied, end, info, start, user
165+
166+
154167
[float]
155168
[[ecs-event-category-authentication]]
156169
==== authentication

‎experimental/generated/ecs/ecs_flat.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2944,6 +2944,24 @@ event.agent_id_status:
29442944
type: keyword
29452945
event.category:
29462946
allowed_values:
2947+
- description: Events in this category annotate API calls that occured on a system.
2948+
Typical sources for those events could be from the Operating System level through
2949+
the native libraries (for example Windows Win32, Linux libc, etc.), or managed
2950+
sources of events (such as ETW, syslog), but can also include network protocols
2951+
(such as SOAP, RPC, Websocket, REST, etc.)
2952+
expected_event_types:
2953+
- access
2954+
- admin
2955+
- allowed
2956+
- change
2957+
- creation
2958+
- deletion
2959+
- denied
2960+
- end
2961+
- info
2962+
- start
2963+
- user
2964+
name: api
29472965
- description: Events in this category are related to the challenge and response
29482966
process in which credentials are supplied and verified to allow the creation
29492967
of a session. Common sources for these logs are Windows event logs and ssh logs.

‎experimental/generated/ecs/ecs_nested.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3936,6 +3936,24 @@ event:
39363936
type: keyword
39373937
event.category:
39383938
allowed_values:
3939+
- description: Events in this category annotate API calls that occured on a
3940+
system. Typical sources for those events could be from the Operating System
3941+
level through the native libraries (for example Windows Win32, Linux libc,
3942+
etc.), or managed sources of events (such as ETW, syslog), but can also
3943+
include network protocols (such as SOAP, RPC, Websocket, REST, etc.)
3944+
expected_event_types:
3945+
- access
3946+
- admin
3947+
- allowed
3948+
- change
3949+
- creation
3950+
- deletion
3951+
- denied
3952+
- end
3953+
- info
3954+
- start
3955+
- user
3956+
name: api
39393957
- description: Events in this category are related to the challenge and response
39403958
process in which credentials are supplied and verified to allow the creation
39413959
of a session. Common sources for these logs are Windows event logs and ssh

‎generated/ecs/ecs_flat.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2875,6 +2875,24 @@ event.agent_id_status:
28752875
type: keyword
28762876
event.category:
28772877
allowed_values:
2878+
- description: Events in this category annotate API calls that occured on a system.
2879+
Typical sources for those events could be from the Operating System level through
2880+
the native libraries (for example Windows Win32, Linux libc, etc.), or managed
2881+
sources of events (such as ETW, syslog), but can also include network protocols
2882+
(such as SOAP, RPC, Websocket, REST, etc.)
2883+
expected_event_types:
2884+
- access
2885+
- admin
2886+
- allowed
2887+
- change
2888+
- creation
2889+
- deletion
2890+
- denied
2891+
- end
2892+
- info
2893+
- start
2894+
- user
2895+
name: api
28782896
- description: Events in this category are related to the challenge and response
28792897
process in which credentials are supplied and verified to allow the creation
28802898
of a session. Common sources for these logs are Windows event logs and ssh logs.

‎generated/ecs/ecs_nested.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3856,6 +3856,24 @@ event:
38563856
type: keyword
38573857
event.category:
38583858
allowed_values:
3859+
- description: Events in this category annotate API calls that occured on a
3860+
system. Typical sources for those events could be from the Operating System
3861+
level through the native libraries (for example Windows Win32, Linux libc,
3862+
etc.), or managed sources of events (such as ETW, syslog), but can also
3863+
include network protocols (such as SOAP, RPC, Websocket, REST, etc.)
3864+
expected_event_types:
3865+
- access
3866+
- admin
3867+
- allowed
3868+
- change
3869+
- creation
3870+
- deletion
3871+
- denied
3872+
- end
3873+
- info
3874+
- start
3875+
- user
3876+
name: api
38593877
- description: Events in this category are related to the challenge and response
38603878
process in which credentials are supplied and verified to allow the creation
38613879
of a session. Common sources for these logs are Windows event logs and ssh

‎schemas/event.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,24 @@
156156
normalize:
157157
- array
158158
allowed_values:
159+
- name: api
160+
description: >
161+
Events in this category annotate API calls that occured on a system. Typical sources
162+
for those events could be from the Operating System level through the native libraries
163+
(for example Windows Win32, Linux libc, etc.), or managed sources of events (such as ETW,
164+
syslog), but can also include network protocols (such as SOAP, RPC, Websocket, REST, etc.)
165+
expected_event_types:
166+
- access
167+
- admin
168+
- allowed
169+
- change
170+
- creation
171+
- deletion
172+
- denied
173+
- end
174+
- info
175+
- start
176+
- user
159177
- name: authentication
160178
description: >
161179
Events in this category are related to the challenge and response process

0 commit comments

Comments
 (0)